Lucene search

GitHub_MCVELIST:CVE-2023-48693

HistoryDec 05, 2023 - 12:24 a.m.

CVE-2023-48693 Azure RTOS ThreadX Remote Code Execution Vulnerability

2023-12-0500:24:47

CWE-20

GitHub_M

www.cve.org

azure rtos

threadx

remote code execution

cve-2023-48693

vulnerability

parameter checking

privilege escalation

upgrade

CVSS3

8.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

62.3%

JSON

Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can cause arbitrary read and write due to vulnerability in parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation. The affected components include RTOS ThreadX v6.2.1 and below. The fixes have been included in ThreadX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CNA Affected

[
  {
    "vendor": "azure-rtos",
    "product": "threadx",
    "versions": [
      {
        "version": "< 6.3.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/azure-rtos/threadx/security/advisories/GHSA-p7w6-62rq-vrf9

CVSS3

8.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

62.3%

JSON

Related for CVELIST:CVE-2023-48693